aboutsummaryrefslogtreecommitdiffstats
path: root/docs/content/error/sce
diff options
context:
space:
mode:
authorKen Sheedlo2013-08-13 16:14:34 -0700
committerIgor Minar2013-08-15 11:51:37 -0700
commit02d42fda6dd56c8c1cd4af8c9c848fcc5210a370 (patch)
treef3dc96caf7213813fc2d2b8f7eccb31e118b6274 /docs/content/error/sce
parent3b6ec782d81e18b257fc84bfb4c4c71d55ffa70c (diff)
downloadangular.js-02d42fda6dd56c8c1cd4af8c9c848fcc5210a370.tar.bz2
chore(minerr): move $sce:insecurl file to sce directory
Closes #3568
Diffstat (limited to 'docs/content/error/sce')
-rw-r--r--docs/content/error/sce/insecurl.ngdoc26
1 files changed, 26 insertions, 0 deletions
diff --git a/docs/content/error/sce/insecurl.ngdoc b/docs/content/error/sce/insecurl.ngdoc
new file mode 100644
index 00000000..b5d3ce84
--- /dev/null
+++ b/docs/content/error/sce/insecurl.ngdoc
@@ -0,0 +1,26 @@
+@ngdoc error
+@name $sce:insecurl
+@fullName Processing of a Resource from Untrusted Source Blocked
+@description
+
+AngularJS' {@link api/ng.$sce#strictcontextualescaping Strict Contextual Escaping (SCE)} mode (enabled by default) has blocked loading a resource from an insecure URL.
+
+Typically, this would occur if you're attempting to load an Angular template from an untrusted source.
+It's also possible that a custom directive threw this error for a similar reason.
+
+Angular only loads templates from trusted URLs (by calling {@link api/ng.$sce#getTrustedResourceUrl $sce.getTrustedResourceUrl} on the template URL).
+
+By default, only URLs that belong to the same origin are trusted. These are urls with the same domain and protocol as the application document.
+
+The {@link api/ng.directive:ngInclude ngInclude} directive and {@link guide/directive directives} that specify a `templateUrl` require a trusted resource URL.
+
+To load templates from other domains and/or protocols, either adjust the {@link
+api/ng.$sceDelegateProvider#resourceUrlWhitelist whitelist}/ {@link
+api/ng.$sceDelegateProvider#resourceUrlBlacklist blacklist} or wrap the URL with a call to {@link
+api/ng.$sce#trustAsResourceUrl $sce.trustAsResourceUrl}.
+
+**Note**: The browser's {@link
+https://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_XMLHttpRequest Same Origin
+Policy} and {@link http://www.w3.org/TR/cors/ Cross-Origin Resource Sharing (CORS)} policy apply
+that may further restrict whether the template is successfully loaded. (e.g. neither cross-domain
+requests won't work on all browsers nor `file://` requests on some browsers)